feat: add Reachability Center and Why Drawer components with tests

- Implemented ReachabilityCenterComponent for displaying asset reachability status with summary and filtering options.
- Added ReachabilityWhyDrawerComponent to show detailed reachability evidence and call paths.
- Created unit tests for both components to ensure functionality and correctness.
- Updated accessibility test results for the new components.

src/Web/StellaOps.Web/tests/e2e/a11y-smoke.spec.ts

@@ -3,9 +3,36 @@ import AxeBuilder from '@axe-core/playwright';
 import fs from 'node:fs';
 import path from 'node:path';
 
+import { policyAuthorSession } from '../../src/app/testing';
+
 const shouldFail = process.env.FAIL_ON_A11Y === '1';
 const reportDir = path.join(process.cwd(), 'test-results');
 
+const mockConfig = {
+  authority: {
+    issuer: 'https://authority.local',
+    clientId: 'stellaops-ui',
+    authorizeEndpoint: 'https://authority.local/connect/authorize',
+    tokenEndpoint: 'https://authority.local/connect/token',
+    logoutEndpoint: 'https://authority.local/connect/logout',
+    redirectUri: 'http://127.0.0.1:4400/auth/callback',
+    postLogoutRedirectUri: 'http://127.0.0.1:4400/',
+    scope:
+      'openid profile email ui.read authority:tenants.read advisory:read vex:read exceptions:read exceptions:approve aoc:verify findings:read orch:read vuln:view vuln:investigate vuln:operate vuln:audit',
+    audience: 'https://scanner.local',
+    dpopAlgorithms: ['ES256'],
+    refreshLeewaySeconds: 60,
+  },
+  apiBaseUrls: {
+    authority: 'https://authority.local',
+    scanner: 'https://scanner.local',
+    policy: 'https://scanner.local',
+    concelier: 'https://concelier.local',
+    attestor: 'https://attestor.local',
+  },
+  quickstartMode: true,
+};
+
 async function writeReport(filename: string, data: unknown) {
   fs.mkdirSync(reportDir, { recursive: true });
   fs.writeFileSync(path.join(reportDir, filename), JSON.stringify(data, null, 2));
@@ -16,7 +43,7 @@ async function runA11y(url: string, page: Page) {
   const results = await new AxeBuilder({ page }).withTags(['wcag2a', 'wcag2aa']).analyze();
   const violations = [...results.violations].sort((a, b) => a.id.localeCompare(b.id));
   await writeReport(
-    `a11y-${url.replace(/\\W+/g, '_') || 'home'}.json`,
+    `a11y-${url.replace(/\W+/g, '_') || 'home'}.json`,
     { url: page.url(), violations }
   );
   if (shouldFail) {
@@ -26,6 +53,25 @@ async function runA11y(url: string, page: Page) {
 }
 
 test.describe('a11y-smoke', () => {
+  test.beforeEach(async ({ page }) => {
+    await page.addInitScript((session) => {
+      try {
+        window.sessionStorage.clear();
+      } catch {
+        // ignore storage errors in restricted contexts
+      }
+      (window as any).__stellaopsTestSession = session;
+    }, policyAuthorSession);
+    await page.route('**/config.json', (route) =>
+      route.fulfill({
+        status: 200,
+        contentType: 'application/json',
+        body: JSON.stringify(mockConfig),
+      })
+    );
+    await page.route('https://authority.local/**', (route) => route.abort());
+  });
+
   test('home page baseline', async ({ page }, testInfo) => {
     const violations = await runA11y('/', page);
     testInfo.annotations.push({

src/Web/StellaOps.Web/tests/e2e/auth.spec.ts

@@ -1,9 +1,8 @@
 import { expect, test } from '@playwright/test';
-import { policyAuthorSession } from '../src/app/testing';
-
-const mockConfig = {
-  authority: {
-    issuer: 'https://authority.local',
+
+const mockConfig = {
+  authority: {
+    issuer: 'https://authority.local',
     clientId: 'stellaops-ui',
     authorizeEndpoint: 'https://authority.local/connect/authorize',
     tokenEndpoint: 'https://authority.local/connect/token',
@@ -16,60 +15,57 @@ const mockConfig = {
     dpopAlgorithms: ['ES256'],
     refreshLeewaySeconds: 60,
   },
-  apiBaseUrls: {
-    authority: 'https://authority.local',
-    scanner: 'https://scanner.local',
-    policy: 'https://scanner.local',
-    concelier: 'https://concelier.local',
-    attestor: 'https://attestor.local',
-  },
-};
-
+  apiBaseUrls: {
+    authority: 'https://authority.local',
+    scanner: 'https://scanner.local',
+    policy: 'https://scanner.local',
+    concelier: 'https://concelier.local',
+    attestor: 'https://attestor.local',
+  },
+  quickstartMode: true,
+};
+
 test.beforeEach(async ({ page }) => {
-  page.on('console', (message) => {
-    // bubble up browser logs for debugging
-    console.log('[browser]', message.type(), message.text());
-  });
-  page.on('pageerror', (error) => {
-    console.log('[pageerror]', error.message);
-  });
-  await page.addInitScript(() => {
-    // Capture attempted redirects so the test can assert against them.
-    (window as any).__stellaopsAssignedUrls = [];
-    const originalAssign = window.location.assign.bind(window.location);
-    window.location.assign = (url: string | URL) => {
-      (window as any).__stellaopsAssignedUrls.push(url.toString());
-    };
-
-    window.sessionStorage.clear();
-    // Seed a default Policy Studio author session so guarded routes load in e2e
-    (window as any).__stellaopsTestSession = policyAuthorSession;
+  page.on('console', (message) => {
+    // bubble up browser logs for debugging
+    console.log('[browser]', message.type(), message.text());
   });
-  await page.route('**/config.json', (route) =>
-    route.fulfill({
-      status: 200,
-      contentType: 'application/json',
-      body: JSON.stringify(mockConfig),
-    })
-  );
-  await page.route('https://authority.local/**', (route) => route.abort());
-});
-
-test('sign-in flow builds Authority authorization URL', async ({ page }) => {
-  await page.goto('/');
-  const signInButton = page.getByRole('button', { name: /sign in/i });
-  await expect(signInButton).toBeVisible();
-  const [request] = await Promise.all([
-    page.waitForRequest('https://authority.local/connect/authorize*'),
-    signInButton.click(),
-  ]);
-
-  const authorizeUrl = new URL(request.url());
-  expect(authorizeUrl.origin).toBe('https://authority.local');
-  expect(authorizeUrl.pathname).toBe('/connect/authorize');
-  expect(authorizeUrl.searchParams.get('client_id')).toBe('stellaops-ui');
-
-});
+  page.on('pageerror', (error) => {
+    console.log('[pageerror]', error.message);
+  });
+  await page.addInitScript(() => {
+    try {
+      window.sessionStorage.clear();
+    } catch {
+      // ignore storage errors in restricted contexts
+    }
+    (window as any).__stellaopsTestSession = undefined;
+  });
+  await page.route('**/config.json', (route) =>
+    route.fulfill({
+      status: 200,
+      contentType: 'application/json',
+      body: JSON.stringify(mockConfig),
+    })
+  );
+  await page.route('https://authority.local/**', (route) => route.abort());
+});
+
+test('sign-in flow builds Authority authorization URL', async ({ page }) => {
+  await page.goto('/');
+  const signInButton = page.getByRole('button', { name: /sign in/i });
+  await expect(signInButton).toBeVisible();
+  const [request] = await Promise.all([
+    page.waitForRequest('https://authority.local/connect/authorize*'),
+    signInButton.click({ noWaitAfter: true }),
+  ]);
+
+  const authorizeUrl = new URL(request.url());
+  expect(authorizeUrl.origin).toBe('https://authority.local');
+  expect(authorizeUrl.pathname).toBe('/connect/authorize');
+  expect(authorizeUrl.searchParams.get('client_id')).toBe('stellaops-ui');
+
+});
 
 test('callback without pending state surfaces error message', async ({ page }) => {
   await page.route('https://authority.local/**', (route) =>